Why Your Data Is At Risk – And What To Do About It

The New Report from Rapid 7

Security vendor Rapid 7 has released a new report analysing the results from penetration tests conducted by it between September 2018 and May 2019.

The report is based on data is taken from 180 real-world internal and external penetration tests conducted on enterprise organisations.

What are the Key Findings?

Domain Admin Access

The report finds that cybercriminals who manage to get access to an internal network have an opportunity to then gain domain administrator access in more than three quarters of cases.

Finding Vulnerabilities

The report also showed that penetration testers are almost always (96% of the time) able to find at least one major vulnerability that impacts data confidentiality or data integrity.

Passwords

Seventy-two percent of the tests resulted in at least one password being compromised. This was often because the passwords were set to common or known defaults, or were easily guessed.

External Network Vulnerabilities

The most common external network vulnerabilities the testers encountered were due to weak transport-layer security. This was as a result of organisations using old encryption standards or, in some cases, no encryption at all.

Incredibly, many of the organisations tested had websites that did not offer any transport privacy at all. Instead these websites were HTTP-only, or they used authentication mechanisms that exposed credentials or cipher suites that were weaker than those currently recommended. Other common external vulnerabilities included outdated or unpatched software.

Web Application Vulnerabilities

Web application vulnerabilities are another type of external vulnerability. The most common issues here included user name enumeration weaknesses that allow an attacker to guess or confirm users on a system; weaknesses that lead to encryption failures for data whilst in transit; and SQL injection and cross-site scripting flaws.

Why Does This Matter?

Most of the vulnerabilities that exist on Internet-facing assets tend be those that impact the confidentiality of data – either by risking exposing the data through weak encryption, or by allowing easy access to that data through poor configuration or insecure development practices.

The chances of your company, and its data (and potentially your customers’ private information), being the target of a malicious hack are very real. And the consequences of any hack are far reaching.

How Can We Mitigate These Risks?

Aside from updating and patching your software regularly, and ensuring your passwords are effective and complex, one of the most proactive and effective things to do is to stay one step ahead of the hackers by conducting your own regular penetration tests on your web applications and networks.

Experienced pen-testers have the tools and knowledge to scale the walls and try every door and loose window catch on your website. If there is a vulnerability, then a good pen tester will find it. And by finding any vulnerabilities before the hackers do, you are armed with the tools to protect your data, and that of your customers, in the most effective way possible.

Speak to phew today about our pen testing expertise and how we can help your business to protect some of its most valuable assets.